Should I connect MCP with OAuth or with an API key?

When do I use OAuth, and when the API key?

OAuth, wherever the client supports it. Claude Code, Claude on the web and desktop, Copilot Studio and ChatGPT describe the browser sign-in in their guides; according to OpenAI, ChatGPT cannot send a key.

So far we have tested Claude Code, both ways.

The API key for scripts, your own agents and software that cannot open a browser. Keep it in an environment variable or a password manager, in no file you share or put in a repository.

How does the OAuth sign-in work?

The assistant opens your instance's sign-in page. You sign in, see which assistant asks for which company and where the browser returns to, and click "Allow".

OAuth is the way for software to sign in on your behalf without seeing your password. The walkthrough uses OAuth 2.1 with PKCE: only the client that started the sign-in can collect the access.

The client registers itself along the way (Dynamic Client Registration). The instance is its own sign-in service, so even when self-hosted no third party is involved.

How long does the OAuth sign-in last?

The assistant gets two tokens, passes with an expiry date. It calls the walkthrough with the access token, which lasts an hour. With the refresh token it gets a new one, and every renewal also replaces the refresh token, which lasts 30 days.

If the same refresh token comes in again within a minute, the server still accepts it. That happens when a client renews twice at once, or an answer is lost on the way.

If it comes in again later, the server treats it as copied and disconnects every assistant of that person, the key included. If the original and a copy both renewed within that minute, it shows once both renew again.

At the latest 90 days after your "Allow", the sign-in ends, however often the assistant renewed. Then you allow it again.

How does the API key work?

In Settings, "Create key" makes a key. It is shown only at that moment and stored nowhere, so the app cannot show it again.

It lasts 90 days, as you and with your role, in the company that was open when you made it. The client sends it in the Authorization header as Bearer.

You hold one key per company. A new one ends the previous key; assistants that signed in through the browser stay connected.

Why do both ask for a recent sign-in?

Both survive signing out of the browser: an assistant stays connected even after you sign out. That is why "Create key" and "Allow" ask for a sign-in from the last 15 minutes.

With an older session the page sends you to sign in and then brings you back.

The app tells you by email about every new connection. If it was not you, disconnect all assistants and change your password.

What ends a connection?

"Disconnect" in Settings ends one connection at its next call. "Disconnect all assistants" and any change to your password end the key and every browser sign-in at once.

If you leave the company or are removed, both end for good. If an admin turns off "Allow AI assistants for this company", every member's connections end. Our article on revoking MCP access has the details.